Re:NSA Ghidra software reverse engineering framework
by doktrin on Wednesday March 29, 2023 @07:16AM
(#35355502)
I am not a SME here, but can at least try to clarify a few of these points for you.
> I'm out of my depth when it comes to loading something up in a debugger or whatever (is ghidra a debugger or what's the difference?)
When you hear "debugger", think "breakpoints". It's any tool that lets you do things like set breakpoints and step through code execution. In the C world, that would be tools like GDB and Valgrind. For Java - the IDEs themselves ship with debuggers (Eclipse, Intellij, etc), or jdb. In the frontend world your browser devtools ships with this functionality.
Debuggers can also typically let you view lower level details of a given binary's execution - like machine code for C, bytecode for Java, etc. They won't however decompile binaries or bytecode into the original higher level language.
Ghidra does come bundled with a debugger, but it can also do lots of other stuff (including decompilation).
> I don't know if that makes me teachable or beyond help, but I'd be an eager student.
If you're actually interested in this stuff, it would probably help to get some baseline familiarity with systems programming. Look up the 15-213 course material and exercises and work through it with the help of video lectures and a tutor - sentience agnostic.
> I'm out of my depth when it comes to loading something up in a debugger or whatever (is ghidra a debugger or what's the difference?)
When you hear "debugger", think "breakpoints". It's any tool that lets you do things like set breakpoints and step through code execution. In the C world, that would be tools like GDB and Valgrind. For Java - the IDEs themselves ship with debuggers (Eclipse, Intellij, etc), or jdb. In the frontend world your browser devtools ships with this functionality.
Debuggers can also typically let you view lower level details of a given binary's execution - like machine code for C, bytecode for Java, etc. They won't however decompile binaries or bytecode into the original higher level language.
Ghidra does come bundled with a debugger, but it can also do lots of other stuff (including decompilation).
> I don't know if that makes me teachable or beyond help, but I'd be an eager student.
If you're actually interested in this stuff, it would probably help to get some baseline familiarity with systems programming. Look up the 15-213 course material and exercises and work through it with the help of video lectures and a tutor - sentience agnostic.